xmrig | 76ac2256aa87942108fe48e00a8fe7bc33adfebd44e65ec7e904964186ff7f3c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c422e58d8c2198473181fc2d7ebe148.exe
Size

784KB
MD5

5c422e58d8c2198473181fc2d7ebe148
SHA1

91ab8ec88e82e6155ae36b9daa8261162457d502
SHA256

76ac2256aa87942108fe48e00a8fe7bc33adfebd44e65ec7e904964186ff7f3c
SHA512

f87a63cfcc4cdaea7683569ea6ff685e6b2191461d13062601617633b726b7e9a34a6489c615c17683a2da64304f18a7775f7bf7e1ded2bf08efd64bbd8c7330
SSDEEP

24576:MoAuNeZ1c1YrU4tsde8zKXZmrH0B73fXGuV:MoAuN4cAyefXUbQ3f

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/3052-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/3052-17-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2640-20-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2640-26-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2640-25-0x0000000003120000-0x00000000032B3000-memory.dmp	xmrig
behavioral1/memory/2640-35-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2640-36-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2640	5c422e58d8c2198473181fc2d7ebe148.exe

Executes dropped EXE 1 IoCs

pid	Process
2640	5c422e58d8c2198473181fc2d7ebe148.exe

Loads dropped DLL 1 IoCs

pid	Process
3052	5c422e58d8c2198473181fc2d7ebe148.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3052-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000900000001225b-10.dat	upx
behavioral1/files/0x000900000001225b-12.dat	upx
behavioral1/memory/3052-15-0x00000000030E0000-0x00000000033F2000-memory.dmp	upx
behavioral1/files/0x000900000001225b-16.dat	upx
behavioral1/memory/2640-18-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3052	5c422e58d8c2198473181fc2d7ebe148.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3052	5c422e58d8c2198473181fc2d7ebe148.exe
2640	5c422e58d8c2198473181fc2d7ebe148.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2640	3052	5c422e58d8c2198473181fc2d7ebe148.exe	29
PID 3052 wrote to memory of 2640	3052	5c422e58d8c2198473181fc2d7ebe148.exe	29
PID 3052 wrote to memory of 2640	3052	5c422e58d8c2198473181fc2d7ebe148.exe	29
PID 3052 wrote to memory of 2640	3052	5c422e58d8c2198473181fc2d7ebe148.exe	29

C:\Users\Admin\AppData\Local\Temp\5c422e58d8c2198473181fc2d7ebe148.exe
"C:\Users\Admin\AppData\Local\Temp\5c422e58d8c2198473181fc2d7ebe148.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\5c422e58d8c2198473181fc2d7ebe148.exe
  C:\Users\Admin\AppData\Local\Temp\5c422e58d8c2198473181fc2d7ebe148.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5c422e58d8c2198473181fc2d7ebe148.exe

Filesize
34KB

MD5
ae3fbe9c415adef6f5ea42f1373b8c26

SHA1
5a3544a0415043e5404913dc208e5c3f9666caf3

SHA256
c1a557356c13526c98a2a88787ccaef0907c854d3366dd69d6fda90c3a6530dc

SHA512
66892eeee12824ecdedc122489df5b7da8d783b481eecca1b4b283239a02a93f5e73e81a101b8b3d10d6450e4083ef8c6cd34b476c2eb5f3fa47ecb3b3f8affa

Download Submit
\Users\Admin\AppData\Local\Temp\5c422e58d8c2198473181fc2d7ebe148.exe

Filesize
146KB

MD5
129d3d04246cbfe896cd76d3a8177587

SHA1
ee1300aebe5f7daae946a6d5ab3d1f32b4f1be7d

SHA256
c07316e12cf575ea2bc7c0193dc0b4c02fb0731e79a9655e14905d85ed617a6e

SHA512
6cb9c240069e585d5fcdcadfd6d547eea6f5eae4874448aa9d039c40cbf3d233cdbc838a46a1d33014d4f2e90335f249e221e30b20fd971336fc839a6b3f4099

Download Submit
memory/2640-18-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2640-19-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2640-20-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2640-26-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2640-25-0x0000000003120000-0x00000000032B3000-memory.dmp

Filesize
1.6MB

Download
memory/2640-35-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2640-36-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3052-3-0x00000000002E0000-0x00000000003A4000-memory.dmp

Filesize
784KB

Download
memory/3052-15-0x00000000030E0000-0x00000000033F2000-memory.dmp

Filesize
3.1MB

Download
memory/3052-14-0x0000000000610000-0x0000000000711000-memory.dmp

Filesize
1.0MB

Download
memory/3052-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3052-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3052-17-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download